DE102021128522A1 - IDENTIFICATION OF NETWORK TRAFFIC RULES - Google Patents

Abstract

A computer-implemented method of analyzing network connections includes identifying a connection of interest and a corresponding set of connection data. The method also includes generating one or more characteristic maps corresponding to the compound of interest. The method also includes associating the generated one or more characteristic mappings with underlying protocols and fields and identifying one or more values corresponding to each of the underlying protocols. The method also includes extracting general correspondences from the identified one or more values that correspond to each of the underlying protocols and fields.

Description

BACKGROUND

The present invention relates generally to the field of network analysis, and more particularly to detecting underlying rules in a network.

Deep learning provides high-performance solutions for asset inventory, asset inventory monitoring, and other network traffic analysis. Enterprise asset management encompasses several key tasks, including asset inventory, asset lifecycle management, and asset inventory monitoring. Deep learning models provide the features with significantly higher performance in terms of metrics like precision, recall, f1 score and the like.

Saliency maps are an image processing technique used to distinguish visual features in images. For example, full color images are converted to black and white to analyze and display the strongest colors present in the image. Other examples may include using night vision technologies to detect and represent light sources, where green may be used to represent brightness and black represents dark areas. Feature mapping concepts are described herein as being extended to applications outside of image analysis and based on features that can be used to describe other than pure image data.

SUMMARY OF THE INVENTION

As disclosed herein, a computer-implemented method for analyzing network connections includes identifying a connection of interest and a corresponding set of connection data. The method also includes generating one or more characteristic maps corresponding to the compound of interest. The method also includes associating the generated one or more characteristic mappings with underlying protocols and fields and identifying one or more values corresponding to each of the underlying protocols. The method also includes extracting general correspondences from the identified one or more values that correspond to each of the underlying protocols and fields. A computer program product and a computer system corresponding to the method are also disclosed.

character list

• 1 Figure 12 is a block diagram illustrating a network traffic analysis system in accordance with at least one embodiment of the present invention;
• 2 Figure 12 is a flowchart illustrating a network traffic analysis method in accordance with at least one embodiment of the present invention;
• 3 Figure 12 illustrates an example byte stream mapping in accordance with at least one embodiment of the present invention;
• 4 12 is a block diagram of components of a data processing system that implements the image analysis system according to an embodiment of the present invention.

DETAILED DESCRIPTION

Characteristic mappings, as described in relation to deep learning, correspond to a visualization technique used to compute images. The technique is derived from the concept of a characteristic in an image that refers to unique features such as pixels, resolution, etc. of the image in the context of visual processing. The unique features uniquely represent locations of interest in an image, and a feature map is a topographical representation of the locations of interest relative to the image. In particular, feature assignments represent the prominence or characteristic of each location in the field of view over a scalar quantity and ultimately determine the selection of unique locations based on the spatial distribution of the feature.

1 10 is a block diagram illustrating a network traffic analysis system 100 in accordance with at least one embodiment of the present invention. As shown, network traffic analysis system 100 includes data processing system 110, network 120, and data processing systems 130. Network traffic analysis system 100 may allow for analysis and identification of rules and dependencies related to connections within a system.

Data processing system 110 may be a desktop computer, a laptop computer, a dedicated computer server, or any computer system known in the art. In some embodiments, the data processing System 110 represents computer systems that use clustered computers to appear as a single pool of seamless resources. In general, data processing system 110 means any electronic device or combination of electronic devices capable of receiving and transmitting data as referred to in FIG 4 is described in more detail. Data processing system 110 may include internal and external hardware components, as referred to in FIG 4 is shown and described in more detail.

As shown, the data processing system 110 includes an application 115 for connection analysis. The connection analysis application 115 can be configured to perform a network traffic analysis method such as that relating to 2 to carry out described. The connection analysis application 115 may be capable of performing any of the operations detailed above or below. In at least some embodiments, connection analysis application 115 is configured to analyze connections between each computing system 110 and computing systems 130A and 130B.

Data processing systems 130 may each be a desktop computer, a laptop computer, a dedicated computer server, or any computer system known in the art. In some embodiments, data processing systems 130 represent computing systems that use clustered computers to act as a single pool of seamless resources. In general, data processing systems 130 represent any electronic device or combination of electronic devices that is or are capable of receiving and transmitting data, as related to FIG 4 is described in more detail. Data processing systems 130 may include internal and external hardware components, as referred to in FIG 4 is shown and described in more detail.

For example, the network 120 may be a local area network (LAN), a wide area network (WAN) such as the Internet, or a combination of both, and may include wired, wireless, or fiber optic connections. In general, network 120 can be any combination of connections and protocols that support communications between data processing system 110 and data processing systems 130 .

2 12 is a flowchart illustrating a network traffic analysis method 200 in accordance with at least one embodiment of the present invention. As illustrated, the network traffic analysis method 200 includes identifying (210) a link of interest, generating (220) characteristic maps corresponding to the link of interest, associating (230) the generated characteristic maps with underlying protocols and fields, identifying (240) one or more values corresponding to each of the underlying protocols and fields, extracting (250) general correspondences from the identified one or more values corresponding to .corresponding to each of the underlying protocols and fields, and generating (260) general rules representing the extracted correspondences.

Identifying (210) a network or link of interest may include receiving an indication of a link or group of links to be analyzed. In at least some embodiments, identifying (210) a link of interest includes identifying a set of network traffic data. The network traffic data can comprise a byte stream or multiple byte streams. In at least some embodiments, identifying (210) a link of interest includes identifying one or more well-defined protocols through which data is sent to the link of interest, respectively.

Generating (220) characteristic maps corresponding to the compound of interest may include translating attention-based modeling into data corresponding to the compound of interest. In at least some embodiments, generating (220) characteristic maps corresponding to the compound of interest comprises applying an attention-based model to one or more data streams corresponding to the compound of interest. The attention-based model can be configured to assign attention weights to different parts of the byte stream. In at least some embodiments, the attention weights are applied to accurately reflect the importance of the analyzed portions of the byte stream. The attention model can divide attention into two types, global attention and local attention. In cases where global attention is implemented, attention is applied to all source positions in the byte stream; in cases where local attention is implemented, attention is only applied in some source positions in the byte stream. In terms of local attention, the positio Positions to which attention is applied that are most likely to contain influential bytes. With respect to global attention, it may not be feasible or imprecise to apply attention to specific or any bytes, such that attention can be applied equally across all byte positions. In additional embodiments, local and global attention may refer to the diversification of how much attention is given to a byte position. For example, a byte stream can be broken up into several larger chunks or segments. With respect to each of these segments, byte positions can have a unique "importance" or weight. Therefore, in such situations, local attention may be applied such that a byte position relative to a first segment has a first weight, and a byte in the same position relative to a second segment has a second weight. In embodiments where identification of such segments is not applicable, or where identification of the various byte positions cannot be performed prior to analysis of the byte stream, global consideration may instead be implemented so as not to improperly characterize values in the byte stream. In at least some embodiments, the attention-based model used is trained on a raw TCP/UDP stream. The model's attention weights provide the characteristic assignments by optically highlighting byte sequences that play an important role in the prediction.

Generating (220) characteristic maps corresponding to the compound of interest may also include building Gaussian pyramids to generate characteristic maps related to one or more characteristics of interest corresponding to the compound of interest. Pyramid representation is a type of multi-scale signal representation in which a signal or image is subjected to repeated smoothing and subsampling. Pyramid representation can be divided into two main types, low pass and band pass. Building a low-pass pyramid involves smoothing an image or a signal and subsampling the smoothed image, sometimes by a factor of 2 along each coordinate direction. The resultant image or signal is then subjected to the same procedure and the cycle is repeated. Each cycle results in a smaller resulting image or signal with more smoothing, but with reduced sampling spatial density. When implemented on an image, a graphical representation of these results yields a pyramid with the original image at the top and the resulting images stacked on top of each other from there. Specifically, Gaussian pyramids are weighted down by using a Gaussian mean and scaled down accordingly. Each pixel or byte containing a local mean corresponds to a neighboring pixel or byte or a lower level of the pyramid.

In some embodiments, generating (220) characteristic maps corresponding to the compound of interest includes aggregating one or more generated characteristic maps over a class to form a rule for the class. To illustrate this point, all connections from units from a specific vendor should be considered. Aggregating cross-connection results can show that a value V in a field k can be very characteristic for the specific provider. For each input, a sliding window sums the attention weights for each sequence. The weights for each sequence are then calculated and summed across instances, where each instance may correspond to a separate connection. The goal of the window is to identify important sequences. Continuing the above example, it can be shown that a sequence "A B C D" in field k can be very characteristic of another provider. Embodiments of the present invention establish characteristic mappings according to byte values; in other words, according to a byte stream, each byte has a value, and the characteristic methods assign a relevance score to each byte. It should be clear that the importance of a value in relation to a byte is entirely dependent on the context of the byte stream, so it is useless to try to generalize which values can be evaluated as important and which cannot. Relevance scores may be assigned to the byte values in terms of an understood importance relative to the context of the received byte stream before the byte stream is received.

Mapping (230) the generated characteristic mappings to underlying protocols and fields may include establishing an association between parts of the byte stream related to the connection of interest and underlying protocols indicated by the parts of the byte stream. For example, referring to a TCP connection, bytes X through (X+K) for position X and X+K can be highlighted by the characteristic assignments. After determining that these bytes or portions are of particular interest based on the results of the characteristic mapping, mapping (230) the generated characteristic mappings to underlying ones Protocols proceed with identifying the position of the bytes and processing whether the position corresponds to a particular field. Referring to the TCP connection example previously described, an analysis of the X through X+K bytes with respect to the TCP connection may reveal that the bytes correspond to a "user-agent" field of the corresponding HTTP protocol. In this case, associating (230) the generated characteristic maps with underlying protocols and fields comprises concatenating the relevant parts of the characteristic maps (ie the parts corresponding to bytes X to X+K, for example) with the field " User Agent" affected by these parts.

3 Figure 12 illustrates an example of a process for mapping sections of a byte stream to an underlying protocol structure and fields. As illustrated, the byte stream is segmented into sections as indicated by the gray scale. Each of these sections is identified as corresponding to one or more fields in the illustrated protocol structure(s). As shown, different portions of the byte stream correspond to a variety of protocol structure types. These correspondences are represented by the lines connecting each portion of the byte stream to one or more fields in one or more of the underlying protocol structures. It should be clear that 3 corresponds to just a single example of a mapping from a characteristic map (or byte stream) to underlying fields and protocols. There may be embodiments in which some

Identifying (240) one or more values corresponding to each of the underlying protocols and fields may include identifying at least one value corresponding to each of the fields related to the relationships between the generated characteristic map and the compound of interest are identified.

Extracting (250) general correspondences from the identified one or more values corresponding to each of the underlying protocols and fields may include identifying one or more entities or one or more characteristics, indicated by the identified one or more values corresponding to each of the underlying protocols and fields. For example, in some cases values relating to particular fields may be indicative of a network address identifying an entity or entity that may provide or receive data conforming to the field in question or the underlying protocol. In other words, the identified one or more values may indicate one or more entities, units, or addresses that affect or contribute to portions of byte streams transmitted over the connection of interest, which may be used pursuant to are extremely important in attention modeling. For example, consider a situation where five portions of a byte stream are identified as of high importance according to a corresponding attention-based model. These parts may be the parts that receive the most attention; that is, the parts that are viewed or that interact the most. In this embodiment, four of the identified portions of the byte stream correspond to a network address X. In other words, these portions of the byte stream affect or are affected by a device located at network address X in one way or another. In such a case it can be assumed that the data provided by or for the device corresponding to the network address X is of high importance.

In additional embodiments, extracting (250) general correspondences from the identified one or more values corresponding to each of the underlying protocols and fields further comprises determining whether the identified one or more values are identified multiple values has or have a relationship to each other. For example, two portions of the byte stream may correspond to requests or commands that are dependent on each other. A simple exemplary embodiment would be one in which an originally identified part of a byte stream provides some X data, and a later part of the byte stream uses part of the X data. Such parts may be tagged or labeled as corresponding or as interdependent.

Generating (260) general rules representing the extracted correspondences may include determining whether there are trends between identified portions of the byte streams, identified values related to the identified portions, and correspondences. For example, generating (260) general rules representing the extracted matches may include determining that each portion of the byte stream that indicates a value of X has been identified as important. A corresponding rule can then be generated such that once it has been determined that a portion of the byte stream corresponds to the value X, this part can immediately be marked as important before any further analysis. For example, if a byte stream has a certain value V in position k, it can be determined that the corresponding entity is connecting to a server X . Identifying such correspondences may also enable creation of subsequent rules based on the assumptions that can be made regarding the correspondences. In other embodiments, generating (260) general rules representing the extracted correspondences includes determining whether all instances of a value correspond to data received from a particular location; in such embodiments, the rule may indicate that each byte stream portion having a value X in a particular field corresponds to data provided by a particular device. Generating such a rule can eliminate a need for pre-analysis in relation to subsequent connections, thereby eliminating a need for additional processing.

4 11 illustrates a block diagram of components of data processing system 110 in accordance with an illustrative embodiment of the present disclosure 4 provides only an illustration of an implementation and does not imply any limitations as to the environments in which various embodiments may be implemented. Many modifications can be made to the illustrated environment.

As shown, computer 400 includes a communications fabric 402 that provides communications between one or more computer processors 404, memory 406, persistent storage 408, communications unit 412, and one or more input/output (I/O) interfaces 414. Communications fabric 402 may be implemented with any architecture suitable for passing data and/or controlling information between processors (such as microprocessors, communications and network processors, etc.). system memory, peripheral units and all other hardware components in a system. For example, communications structure 402 may be implemented with one or more buses.

Memory 406 and persistent storage 408 are computer-readable storage media. In this embodiment, memory 406 includes random access memory (RAM) 416 and cache memory 418. In general, memory 406 may include any suitable volatile or non-volatile computer-readable storage medium.

One or more programs may be stored in persistent storage 408 for access and/or execution by one or more of the respective computer processors 404 via one or more working memories of working memory 406 . In this embodiment, persistent storage 408 comprises a magnetic hard drive. Alternatively or in addition to a magnetic hard drive, the persistent storage 408 may be a solid state hard drive memory, a solid state memory device, a read only memory (ROM), an erasable programmable read only memory (EPROM), a flash memory or include any other computer-readable storage medium capable of storing program instructions or digital information.

The media used by persistent storage 408 may also be removable. For example, a removable hard drive for persistent storage 408 may be used. Other examples include optical and magnetic disks, thumb drives, and smart cards inserted into a drive for data transfer to another computer-readable storage medium that is also part of persistent storage 408 .

Communications unit 412, in these examples, provides communications with other data processing systems or devices. In these examples, communications unit 412 includes one or more network interface cards. Communications unit 412 may provide communications through the use of physical and/or wireless communications links.

I/O interface(s) 414 allow for the input and output of data with other devices that may be connected to computer 400 . For example, I/O interface 414 may provide a connection to external devices 420, such as a keyboard, keypad, touch screen, and/or other suitable input device. External devices 420 may also include portable computer-readable storage media, such as USB flash drives, portable optical or magnetic disks, and memory cards. The software and data used to practice embodiments of the present invention may be stored on such portable computer-readable storage media and loaded onto persistent storage 408 via I/O interface(s) 414 . The I/O Interface(s) 414 is also connected to a display 422 .

Display 422 provides a mechanism for displaying data to a user and can be, for example, a computer monitor.

The programs described herein are identified based on the application for which they are implemented in a particular embodiment of the invention. However, it should be understood that any particular program nomenclature is used herein for convenience only, and thus the invention is not intended to be limited solely to use in a particular identified application and/or implemented by such nomenclature.

The present invention can be a system, a method and/or a computer program product at any possible level of technical detail integration. The computer program product may include a computer-readable storage medium (or media) on which are stored computer-readable program instructions for causing a processor to carry out aspects of the present invention.

The computer-readable storage medium may be a physical device that can retain and store instructions for use by an instruction-executing device. The computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: portable computer disk, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory ( EPROM or flash memory), static random access memory (SRAM), portable CD-ROM, DVD, memory stick, floppy disk, a mechanically encoded device such as punched cards or raised structures in a groove that has instructions stored, and any suitable combination of the foregoing. A computer-readable storage medium, as used herein, should not be construed as transient signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., through a fiber optic cable conducted pulses of light) or electrical signals transmitted through a wire.

Computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to respective computing/processing devices, or over a network such as the Internet, a local area network, a wide area network, and/or a wireless network to an external computer or device storage unit to be downloaded. The network may include copper transmission cables, fiber optic transmission lines, wireless transmission, routers, firewalls, switches, gateway computers, and/or edge servers. A network adapter card or network interface in each computing/processing unit receives computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium within the corresponding computing/processing unit.

Computer-readable program instructions for performing operations of the present invention may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state-setting data, integrated circuit configuration data or either source code or object code written in any combination of one or more programming languages, including object-oriented programming languages such as Smalltalk, C++, or the like, and procedural programming languages such as the "C" programming language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server will. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, via the internet using an internet service provider). In some embodiments, electronic circuits, including, for example, programmable logic circuits, field-programmable gate arrays (FPGA, field program mable gate arrays) or programmable logic arrays (PLA) that execute computer-readable program instructions by utilizing state information of the computer-readable program instructions to personalize the electronic circuitry to perform aspects of the present invention.

Aspects of the present invention are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It should be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented using computer readable program instructions.

These computer-readable program instructions may be provided to a processor of a computer or other programmable computing device to create a machine such that the instructions executed by the processor of the computer or other programmable computing device provide means for implementing the instructions in the block or create the functions/steps indicated in the blocks of the flowcharts and/or the block diagrams. These computer-readable program instructions may also be stored on a computer-readable storage medium capable of controlling a computer, programmable computing device, and/or other device to operate in a particular manner such that the computer-readable storage medium, a product of manufacture having instructions stored thereon, including instructions that implement aspects of the function/step identified in the flowchart block(s) and/or block diagrams.

The computer-readable program instructions may also be loaded onto a computer, other programmable data processing device, or other device to cause a series of operations to be performed on the computer, other programmable data processing device, or other device to cause a computer implemented process such that the instructions executed on the computer, other programmable device, or other entity implement the functions/steps indicated in the block(s) of the flowchart diagrams and/or block diagrams.

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, comprising one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in sequence may actually be performed as one step being performed concurrently, substantially concurrently, in a partially or fully temporally overlapping manner, or the blocks may sometimes be performed in the reverse order, depending on the functionality involved . It is further noted that each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations, may be implemented by specific hardware-based systems that perform the specified functions or acts, or combinations of special-purpose hardware and execute computer instructions.

The descriptions of the various embodiments of the present invention have been presented for purposes of illustration, but are in no way intended to be exhaustive or limited to the embodiments disclosed. Many modifications and variations will become apparent to those skilled in the art without departing from the scope and spirit of the invention. The terminology used herein has been chosen to best explain the principles of the embodiment, the practical application or technical improvement over technologies found on the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims (9)

A computer-implemented method for analyzing network connections, the method comprising: identifying a connection of interest and a corresponding set of connection data; generating one or more characteristic maps corresponding to the compound of interest, associating the generated one or more characteristic maps with underlying ones protocols and fields, identifying one or more values corresponding to each of the underlying protocols and fields; and extracting, from the identified one or more values, general correspondences that correspond to each of the underlying protocols and fields. Process implemented by a computer claim 1 , further comprising generating general rules representing the extracted matches. Process implemented by a computer claim 1 wherein generating one or more characteristic maps corresponding to the link of interest comprises creating a map indicating attention directed to portions of data transmitted over the link of interest. Process implemented by a computer claim 1 , where the corresponding group of connection data comprises one or more byte streams. Process implemented by a computer claim 4 , wherein generating one or more characteristic maps corresponding to the compound of interest comprises generating one or more characteristic maps corresponding to the one or more byte streams such that parts of the byte stream are optical according to the consideration be highlighted, which is given to them. Process implemented by a computer claim 5 , wherein mapping the generated one or more characteristic mappings comprises mapping one or more portions of the byte stream to underlying fields or protocols affected by the one or more portions of the byte stream. Process implemented by a computer claim 4 wherein generating characteristic maps corresponding to the compound of interest comprises: identifying a context corresponding to the received one or more byte streams; analyzing the byte stream to determine levels of importance corresponding to one or more values in the byte stream with respect to the identified context; and assigning one or more weights to the values in the byte stream based on the determined importance levels. Computer program product for analyzing network connections, the computer program product having: one or more computer-readable storage media and program instructions stored on the one or more computer-readable storage media, the program instructions comprising instructions for: identifying a connection of interest, generating characteristic maps corresponding to the compound of interest, mapping the generated characteristic mappings to underlying protocols and fields, identifying one or more values corresponding to each of the underlying protocols and fields; and Extracting from the identified one or more values, general correspondences that correspond to each of the underlying protocols and fields. Computer system for analyzing network connections, the computer system comprising: one or more computer processors; one or more computer-readable storage media; Program instructions stored on the computer-readable storage media for execution by at least one of the one or more processors, the program instructions including instructions to: identifying a connection of interest, generating characteristic maps corresponding to the compound of interest, mapping the generated characteristic mappings to underlying protocols and fields, identifying one or more values corresponding to each of the underlying protocols and fields; and Extracting from the identified one or more values, general correspondences that correspond to each of the underlying protocols and fields.

Images